@gjermundgaraba/clankerauth-sdk 0.28.0 → 0.29.0

package/README.md

@@ -17,7 +17,7 @@ vp add effect
 The `/session` and `/effect-actions` entry points also need effect-actions, an optional peer. Install this range: the SDK's declarations are built against it, and under `skipLibCheck` they silently degrade to `any` with another.
 
 ```sh
-vp add @gjermundgaraba/effect-actions@^0.19.0
+vp add @gjermundgaraba/effect-actions@^0.20.0
 ```
 
 ## Entry points

package/dist/request-policy.js

@@ -47,8 +47,8 @@ export const make = (options) => {
             const request = yield* HttpServerRequest.HttpServerRequest;
             const permitted = allows({
                 target: request.originalUrl,
-                host: request.headers.host,
-                origin: request.headers.origin,
+                host: request.headers["host"],
+                origin: request.headers["origin"],
             });
             return permitted ? yield* httpEffect : forbidden;
         })),

package/dist/resource.js

@@ -152,7 +152,7 @@ export const make = (authentication, declaration) => {
         const noteHost = Effect.gen(function* () {
             if (yield* Ref.get(warned))
                 return;
-            const reached = (yield* HttpServerRequest.HttpServerRequest).headers.host;
+            const reached = (yield* HttpServerRequest.HttpServerRequest).headers["host"];
             if (reached === undefined || reached === host)
                 return;
             yield* Ref.set(warned, true);

package/dist/testing.d.ts

@@ -1,18 +1,21 @@
-/** Claims set on a signed token. Each one overrides this issuer's default. */
+/**
+ * Claims set on a signed token. Each one overrides this issuer's default; one set to `undefined`
+ * is left out.
+ */
 export interface TokenClaims {
-    readonly iss?: string;
-    readonly sub?: string;
-    readonly aud?: string | Array<string>;
-    readonly iat?: number;
+    readonly iss?: string | undefined;
+    readonly sub?: string | undefined;
+    readonly aud?: string | Array<string> | undefined;
+    readonly iat?: number | undefined;
     /** Epoch seconds. Default: five minutes from now. */
-    readonly exp?: number;
+    readonly exp?: number | undefined;
     /** Space-separated, as the wire carries it. */
-    readonly scope?: string;
-    readonly client_id?: string;
+    readonly scope?: string | undefined;
+    readonly client_id?: string | undefined;
     /** Proof of possession, for checking that a sender-constrained token is refused. */
     readonly cnf?: {
         readonly jkt: string;
-    };
+    } | undefined;
 }
 export interface FakeIssuerOptions {
     /** The resource identifier tokens are minted for: an application's public origin root. */

package/dist/testing.js

@@ -69,7 +69,8 @@ export const startFakeIssuer = async (options) => {
         issuer,
         sign: (claims = {}, typ = "at+jwt") => {
             const now = Math.floor(Date.now() / 1000);
-            return new SignJWT({
+            const payload = {};
+            for (const [name, value] of Object.entries({
                 iss: issuer,
                 sub: subject,
                 aud: options.resource,
@@ -78,7 +79,10 @@ export const startFakeIssuer = async (options) => {
                 client_id: "fixture",
                 scope: options.scopes.join(" "),
                 ...claims,
-            })
+            }))
+                if (value !== undefined)
+                    payload[name] = value;
+            return new SignJWT(payload)
                 .setProtectedHeader({ alg: "EdDSA", kid: "fixture", typ })
                 .sign(pair.privateKey);
         },

package/dist/verify.d.ts

@@ -33,7 +33,7 @@ export interface Options {
     readonly store: Store;
     readonly requiredScopes?: readonly string[];
     /** `false` refuses API keys without reading the issuer's key list; only OAuth access tokens are accepted. */
-    readonly apiKeys?: boolean;
+    readonly apiKeys?: boolean | undefined;
 }
 export interface Verifier {
     readonly verifyToken: (token: string) => Effect.Effect<Principal, AuthenticationError>;

package/dist/verify.js

@@ -135,7 +135,7 @@ export const make = Effect.fn("Verifier.make")(function* (options) {
     });
     const verifyJwt = Effect.fn("Verifier.jwt")(function* (token) {
         const payload = yield* verifySigned(token, "at+jwt");
-        if (payload.cnf !== undefined)
+        if (payload["cnf"] !== undefined)
             return yield* unauthorized();
         const claims = yield* Schema.decodeUnknownEffect(Claims)(payload).pipe(Effect.mapError(unauthorized));
         return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gjermundgaraba/clankerauth-sdk",
-  "version": "0.28.0",
+  "version": "0.29.0",
   "description": "Effect-native clankerauth access-token and offline API-key verification, with optional effect-actions integration",
   "license": "MIT",
   "repository": {
@@ -52,19 +52,19 @@
     "proper-lockfile": "4.1.2"
   },
   "devDependencies": {
-    "@effect/vitest": "4.0.5",
-    "@gjermundgaraba/effect-actions": "0.19.0",
+    "@effect/vitest": "4.0.6",
+    "@gjermundgaraba/effect-actions": "0.20.0",
     "@modelcontextprotocol/client": "2.3.1",
     "@types/node": "26.6.5",
     "@types/proper-lockfile": "4.1.4",
-    "effect": "4.0.5",
+    "effect": "4.0.6",
     "typescript": "7.0.2",
-    "vite": "npm:@voidzero-dev/vite-plus-core@1.3.0",
-    "vite-plus": "1.3.0",
+    "vite": "npm:@voidzero-dev/vite-plus-core@1.4.0",
+    "vite-plus": "1.4.0",
     "vitest": "5.0.5"
   },
   "peerDependencies": {
-    "@gjermundgaraba/effect-actions": "^0.19.0",
+    "@gjermundgaraba/effect-actions": "^0.20.0",
     "effect": "~4.0.4"
   },
   "peerDependenciesMeta": {